Conciseness

The ~290-line body is dense and almost entirely domain-specific (scope tables, sample-size tables, fingerprint rules, verdict exemplars) with essentially no explanation of concepts Claude already knows, so it sits above anchor 3. It falls short of anchor 5's 'every token earns its place' only in minor places: the cross-reference paragraph near the top duplicates the Step 4 handoff table, and the full report template plus two worked examples per verdict could be trimmed by roughly a fifth without losing guidance.

Actionability

Guidance is fully executable throughout: exact commands (`gh api repos/<owner>/<repo>/branches/main/protection`, `grep -rnE "required_approving_review_count|enforce_admins" --include='*.tf' .`), named output files with field-by-field tables (`evidence-requests.md`, `control-matrix.md`), literal fingerprint formats with five examples, and a runnable validator (`node references/validate-findings.mjs findings.json`). Anchor 5 ('copy-paste ready; specific examples cover the common cases') fits; anchor 4 would require minor gaps in the concrete detail, and none stand out.

Workflow Clarity

Five explicitly sequenced steps (Scope → inventory → evidence requests → test/hand off → verify then record) with real validation checkpoints: "run the refutation pass in references/verification.md before anything is confirmed" and "Validate it and fix every error: node references/validate-findings.mjs findings.json", plus a re-run feedback loop (match by fingerprint, re-sample per new period). Anchor 5 ('clear sequence with explicit validation steps; feedback loops') matches; the destructive/batch cap does not apply because validation is present.

Progressive Disclosure

Framework bulk is externalized one level deep into three clearly linked reference files (soc2.md, iso27001.md, nist-800-53.md, all present in references/), shared formats live in findings-format.md / verification.md / severity-calibration.md / validate-findings.mjs / to-sarif.mjs, all of which exist in the bundle, and the body keeps only the overview, workflow and output spec. Anchor 5 ('clear overview with well-signaled one-level-deep references; content appropriately split') fits; there is no multi-level nesting and no buried or inlined content that clearly belongs in a reference file.

Specificity

The description enumerates six concrete actions with sub-detail — "Scope the audit (criteria or baseline, systems, period, Type 1 vs Type 2)", "build the control inventory", "write an evidence request per control (artifact, owner, sample, test method)", "test what the repo and configs show", "hand technical checks to the owning skill", "record control gaps ... with a control matrix" — comprehensive coverage with no vague filler. Anchor 5 ('lists multiple specific concrete actions; comprehensive coverage') fits; anchor 4 would require minor coverage gaps, and none are evident.

Completeness

Both questions are answered explicitly: the 'what' is the opening action list, and the 'when' is a dedicated "Use when the user mentions ... or is getting ready for an external auditor or assessor" clause with concrete trigger phrases. This is the anchor-5 pattern exactly ('clearly and explicitly answers both what AND when with concrete trigger phrases'); anchor 4 would require the 'when' to be less explicit, which it is not.

Trigger Term Quality

Seventeen natural trigger phrases spanning all three frameworks plus synonyms users actually say: 'SOC 2,' 'SOC 2 Type 2,' 'Trust Services Criteria,' 'ISO 27001,' 'ISMS,' 'Statement of Applicability,' 'Annex A controls,' 'NIST 800-53,' 'FedRAMP,' 'FedRAMP 20x,' 'SSP,' 'POA&M,' 'control matrix,' 'evidence request list,' 'PBC list,' 'audit readiness,' 'control testing,' plus the natural-language condition "is getting ready for an external auditor or assessor". This matches anchor 5 (comprehensive coverage including synonyms); anchor 4 would require missing natural terms, and even the auditor shorthand 'PBC list' is present.

Distinctiveness Conflict Risk

The niche is sharply defined — control-level audit readiness for exactly SOC 2 / ISO 27001:2022 / 800-53 Rev. 5 / FedRAMP — with framework-specific triggers (Trust Services Criteria, Statement of Applicability, POA&M) that no adjacent skill (code-facing pci/hipaa audits, CSF mapping, single-finding triage) would claim. Anchor 5 ('clear niche with distinct triggers; minimal conflict risk') fits better than anchor 4, which requires identifiable overlap risk with closely related skills.